CVE-2021-33771

Windows Kernel Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31979, CVE-2021-34514.

Recent assessments:

gwillcox-r7 at July 14, 2021 5:35pm UTC reported:

Update: Looks like this was used by the exploit brokerage company Candiru along with CVE-2021-31979 to deliver spyware to targeted users, which according to Microsoft’s blog post, affected at least 100 victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, United Kingdom, Turkey, Armenia, and Singapore. Victims include human rights defenders, dissidents, journalists, activists, and politicians.

Hmm interesting so this bug only affects Windows 8.1 and later according to <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771&gt;, despite also being disclosed in the same month as CVE-2021-31979, another bug that affected everything from Windows 7 and later onwards. Both bugs however affect the Windows Kernel and are being actively exploited in the wild for LPE.

There is little information on what actually is the issue here, although <https://twitter.com/mavillon1/status/1415149124064878593/&gt; suggests that MiFlashDataSecton, EtwpUpdatePeriodicCaptureState and AlpcpProcessSynchronousRequest may be possible culprits and reviewing AlpcpProcessSynchronousRequest shows that a potential integer overflow was fixed.

Given that Microsoft also lists the attack complexity for both vulnerabilities as Low it seems likely that other researchers will find a way to replicate these vulnerabilities and create working PoCs for them, particularly given that they have been exploited in the wild. Based on this evidence, it is highly recommended to patch these issues as soon as possible.

Further updates will be made to this post if and when these CVEs are tied to specific vulnerable functions.

NinjaOperator at July 13, 2021 7:53pm UTC reported:

Update: Looks like this was used by the exploit brokerage company Candiru along with CVE-2021-31979 to deliver spyware to targeted users, which according to Microsoft’s blog post, affected at least 100 victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, United Kingdom, Turkey, Armenia, and Singapore. Victims include human rights defenders, dissidents, journalists, activists, and politicians.

Hmm interesting so this bug only affects Windows 8.1 and later according to <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771&gt;, despite also being disclosed in the same month as CVE-2021-31979, another bug that affected everything from Windows 7 and later onwards. Both bugs however affect the Windows Kernel and are being actively exploited in the wild for LPE.

There is little information on what actually is the issue here, although <https://twitter.com/mavillon1/status/1415149124064878593/&gt; suggests that MiFlashDataSecton, EtwpUpdatePeriodicCaptureState and AlpcpProcessSynchronousRequest may be possible culprits and reviewing AlpcpProcessSynchronousRequest shows that a potential integer overflow was fixed.

Given that Microsoft also lists the attack complexity for both vulnerabilities as Low it seems likely that other researchers will find a way to replicate these vulnerabilities and create working PoCs for them, particularly given that they have been exploited in the wild. Based on this evidence, it is highly recommended to patch these issues as soon as possible.

Further updates will be made to this post if and when these CVEs are tied to specific vulnerable functions.

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 4